Connections

Back Next

Configuring Kerberos authentication

Before you use Kerberos authentication to connect to Microsoft SQL Server on Linux or Windows, the organization administrator needs to perform the prerequisite tasks.

To configure the Java Authentication and Authorization Service configuration file (JAAS), perform the following tasks:

Create a JAAS configuration file on the Secure Agent machine.

Add the following entries to the JAAS configuration file:

JDBC_DRIVER_01 {
com.sun.security.auth.module.Krb5LoginModule required
useTicketCache=true
};

Ensure that you specify each key-value pair on a separate line. You can update the values of the given configuration or add additional configuration details according to your requirements.

To configure the

krb5.conf

file, perform the following tasks:

Create a

krb5.conf

file on the Secure Agent machine.

Add the details of the Key Distribution Center (KDC) and admin server to the

krb5.conf

file in the following format:

[libdefaults]
default_realm = <Realm name>
forwardable = true
ticket_lifetime = 24h

[realms]
<REALM NAME> = {
kdc = <Location where KDC is installed> 
admin_server = <Location where KDC is installed>
}
[domain_realm]
<domain name or host name> = <Domain name or host name of Kerberos>
<domain name or host name> = <Domain name or host name of Kerberos>

Ensure that you don’t set user-specific values in any key-value pair. You can update the values of the given configuration or add additional configuration details according to your requirements.

To generate the credential cache file on the Secure Agent machine, perform the following tasks:

On the Secure Agent machine, run the following command and specify the Microsoft SQL Server user name and realm name:

kinit <user name>@<realm_name>

When prompted, enter the password for the Kerberos principal user.

Optionally, when you connect to a Microsoft SQL Server database on Linux, you can run the following command to generate the credential cache file with the specified file name and directory on the Secure Agent machine:

kinit -c <Directory and file name where you want to create the credential cache> <user name>@<realm_name>

Add the KRB5_CONFIG, KRB5CCNAME, and JAASCONFIG properties in the

Metadata Advanced Connection Properties

field in the Microsoft SQL Server connection.

For example, add the properties in the following format:

KRB5_CONFIG=<Absolute path of the Kerberos configuration file>\krb5.conf;KRB5CCNAME=<Absolute path of the credential cache file>/<File name>;JAASCONFIG=<Absolute path of the JAAS config file>\<File name>.conf

Ensure that you separate each key-value pair with a semicolon.

Add the KRB5_CONFIG and KRB5CCNAME properties in the

Runtime Advanced Connection Properties

field in the Microsoft SQL Server connection.

For example, add the properties in the following format:

KRB5_CONFIG=<Absolute path of the Kerberos configuration file>\krb5.conf;KRB5CCNAME=<Absolute path of the credential cache file>/<File name>

Ensure that you separate each key-value pair with a semicolon.

Optionally, set the environment variables on the Secure Agent machine.

If you set the environment variables, you can't use more than one Kerberos principal user in a connection.

Set the following environment variables:

setenv KRB5CCNAME <Absolute path and file name of the credentials cache file>

setenv KRB5_CONFIG <Absolute path of the Kerberos configuration file>\krb5.conf

setenv JAASCONFIG <Absolute path of the JAAS config file>\<File name>.conf

Restart the Secure Agent.

Ensure that the user who runs the mapping has read access to the files related to Kerberos authentication on the Secure Agent.

Rename Saved Search

Table of Contents

Connections

Connections

Configuring Kerberos authentication

Configuring Kerberos authentication